Tor2Mine

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

Depending upon the privileges of the user, the script also performs creation of scheduled tasks and Windows services to maintain persistence on the host.

Using “xp_cmdshell” the threat actors first executed a PowerShell command on the SQL server. The command contained base64 encoded content, which, upon execution, established a connection to a Cobalt Strike command and control server.

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server. The “xp_cmdshell” allows users with sysadmin privilege to execute shell commands on the host.

Around 15 minutes after initial access, the threat actors then moved laterally toward domain controllers and file shares using remote service creation. These services were used to execute the same PowerShell commands, download and execute the Tor2Mine malware.

Depending upon the privileges of the user, the script also performs creation of scheduled tasks and Windows services to maintain persistence on the host.

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

The PowerShell script, checking.ps1, is explained in the Execution section which contained other ways to disable AV, including registry modifications and service disabling.

Depending upon the privileges of the user, the script also performs creation of scheduled tasks and Windows services to maintain persistence on the host.

Depending upon the privileges of the user, the script also performs creation of scheduled tasks and Windows services to maintain persistence on the host.

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

Depending upon the privileges of the user, the script also performs creation of scheduled tasks and Windows services to maintain persistence on the host.

The command contained base64 encoded content, which, upon execution, established a connection to a Cobalt Strike command and control server.

In the script checking.ps1 the threat actor created 16 different tasks on the hosts where Tor2Mine was deployed. These tasks were named in a manner to try and blend in with various Windows tasks.

Upon successfully discovering the password, the threat actors enabled “xp_cmdshell” on the SQL server.

The PowerShell script, checking.ps1, is explained in the Execution section which contained other ways to disable AV, including registry modifications and service disabling.

Tor2Mine was used to access the LSASS memory space and the access granted was 0x1010. On the beachhead, we observed the execution of credential dumping utility Invoke-PowerDump.

The initial access occurred via a brute-force attack, where the threat actors mainly targeted the System Admin (“sa”) account. During the intrusion, we observed over 10,000 failed attempts before successful login.

The threat actor was observed running whoami from the Tor2Mine PowerShell process on the beachhead. "C:\Windows\system32\whoami.exe" /user

During the course of the intrusion, we observed port discovery (port 445) activity from the beachhead. We attribute this to the invocation of the PowerShell command Invoke-SMBExec.

Around 15 minutes after initial access, the threat actors then moved laterally toward domain controllers and file shares using remote service creation.

The command contained base64 encoded content, which, upon execution, established a connection to a Cobalt Strike command and control server.

The Windows Defender AV Real-Time Monitoring was disabled on the beachhead and one of the domain controllers using Set-MpPreference cmdlet.